#!/usr/bin/env python
# -*- encoding: utf-8 -*-
# A simple and fast sub domains brute tool for pentesters
# my[at]lijiejie.com (http://www.lijiejie.com)

import Queue as Queue
import sys
import dns.resolver
import threading
import time
import os

class DNSBrute:
    def __init__(self, target, dns_server_list, name_list, sub_list, threads_num=10):
        self.target = target.strip()
        self.ignore_intranet = False
        self.thread_count = self.threads_num = threads_num
        self.scan_count = self.found_count = 0
        self.lock = threading.Lock()
        self.resolvers = [dns.resolver.Resolver() for _ in range(threads_num)]
        self._load_dns_servers(dns_server_list)
        self._load_sub_names(name_list)
        self._load_next_sub(sub_list)
        self.ip_dict = {}
        self.STOP_ME = False

    def _load_dns_servers(self,dns_server_list):
        self.dns_servers = dns_server_list
        self.dns_count = len(dns_server_list)

    def _load_sub_names(self,name_list):
        self.queue = Queue.Queue()
        for line in name_list:
            sub = line.strip()
            if sub:
                self.queue.put(sub)

    def _load_next_sub(self,sub_list):
        next_subs = []
        for line in sub_list:
            sub = line.strip()
            if sub and sub not in next_subs:
               next_subs.append(sub)
        self.next_subs = next_subs

    def _update_scan_count(self):
        self.lock.acquire()
        self.scan_count += 1
        self.lock.release()

    def _print_progress(self):
        self.lock.acquire()
        msg = '%s found | %s remaining | %s scanned in %.2f seconds' % (
            self.found_count, self.queue.qsize(), self.scan_count, time.time() - self.start_time)
        #sys.stdout.write('\r' + msg)
        #sys.stdout.flush()
        self.lock.release()

    @staticmethod
    def is_intranet(ip):
        ret = ip.split('.')
        if not len(ret) == 4:
            return True
        if ret[0] == '10':
            return True
        if ret[0] == '172' and 16 <= int(ret[1]) <= 32:
            return True
        if ret[0] == '192' and ret[1] == '168':
            return True
        return False

    def _scan(self):
        thread_id = int( threading.currentThread().getName() )
        self.resolvers[thread_id].nameservers.insert(0, self.dns_servers[thread_id % self.dns_count])
        self.resolvers[thread_id].lifetime = self.resolvers[thread_id].timeout = 10.0
        while self.queue.qsize() > 0 and not self.STOP_ME and self.found_count < 4000:    # limit found count to 4000
            sub = self.queue.get(timeout=1.0)
            for _ in range(6):
                try:
                    cur_sub_domain = sub + '.' + self.target
                    answers = d.resolvers[thread_id].query(cur_sub_domain)
                    is_wildcard_record = False
                    if answers:
                        for answer in answers:
                            self.lock.acquire()
                            if answer.address not in self.ip_dict:
                                self.ip_dict[answer.address] = 1
                            else:
                                self.ip_dict[answer.address] += 1
                                if self.ip_dict[answer.address] > 2:    # a wildcard DNS record
                                    is_wildcard_record = True
                            self.lock.release()
                        if is_wildcard_record:
                            self._update_scan_count()
                            self._print_progress()
                            continue
                        ###################################
                        ips = ', '.join([answer.address for answer in answers])
                        if (not self.ignore_intranet) or (not DNSBrute.is_intranet(answers[0].address)):
                            self.lock.acquire()
                            self.found_count += 1
                            msg = cur_sub_domain.ljust(30) + ips
                            ##########################################################################
                            #self.outfile.write(cur_sub_domain.ljust(30) + '\t' + ips + '\n')
                            print(cur_sub_domain,ips,type(ips))
                            self.lock.release()
                            for i in self.next_subs:
                                self.queue.put(i + '.' + sub)
                        ########################################################
                        break
                except dns.resolver.NoNameservers as e:
                    break
                except Exception as e:
                    pass
            self._update_scan_count()
            self._print_progress()
        self._print_progress()
        self.lock.acquire()
        self.thread_count -= 1
        self.lock.release()

    def run(self):
        self.start_time = time.time()
        for i in range(self.threads_num):
            t = threading.Thread(target=self._scan, name=str(i))
            t.setDaemon(True)
            t.start()
        while self.thread_count > 1:
            try:
                time.sleep(1.0)
            except KeyboardInterrupt as e:
                msg = '[WARNING] User aborted, wait all slave threads to exit...'
                sys.stdout.write('\r' + msg + '\n\r')
                sys.stdout.flush()
                self.STOP_ME = True

if __name__ == '__main__':
    PATH = './dict/'
    dns_server_list = ['114.114.114.114','114.114.115.115','180.76.76.76','223.5.5.5','223.6.6.6']
    name_list = open(PATH+'subnames.txt').readlines()
    sub_list = open(PATH+'next_sub.txt').readlines()
    d = DNSBrute('qq.com',dns_server_list,name_list,sub_list)
    d.run()
